Confluence Unauthenticated Remote Code Execution (CVE-2022-26134)

CVE-2022-26134 is an unauthenticated remote code execution vulnerability affecting Atlassian Confluence Server and Data Center. Publicly disclosed in June 2022, this vulnerability allows unauthenticated attackers to execute arbitrary code on vulnerable Confluence servers. The vulnerability stems from insufficient input validation, allowing OGNL injection via specially crafted HTTP requests. Exploitation attempts were observed shortly after the vulnerability became public, with attackers leveraging it to deploy web shells, cryptominers, and other malicious payloads. This vulnerability has been widely exploited, making it a significant threat to organizations using affected Confluence versions. Successful exploitation grants attackers complete control over the Confluence server, enabling data theft, lateral movement, and further malicious activities within the network.

Attack Chain

1. The attacker sends a crafted HTTP request to the Confluence server targeting a vulnerable endpoint, such as a page or a component.
2. The malicious request contains an OGNL expression injected within a URL parameter (e.g., using ${} sequences or URL-encoded variations like %2F%7B).
3. The Confluence server processes the request and executes the injected OGNL expression due to insufficient input validation.
4. The OGNL expression leverages Java runtime execution capabilities (e.g., java.lang.Runtime.getRuntime().exec()) to execute arbitrary commands on the server.
5. The attacker uses the executed commands to download and execute a malicious payload from an external server using tools like wget or curl.
6. The malicious payload installs a web shell (e.g., a JSP file) on the Confluence server, providing persistent remote access.
7. The attacker uses the web shell to further explore the compromised system, steal sensitive data, or move laterally within the network.
8. The attacker may deploy cryptominers, ransomware, or other malicious software, impacting the availability and integrity of the Confluence server and potentially the entire network.

Impact

Successful exploitation of CVE-2022-26134 allows unauthenticated attackers to gain complete control over vulnerable Atlassian Confluence servers. This can lead to data breaches, with sensitive information stored in Confluence exposed to unauthorized access. Attackers can also use compromised Confluence servers as a beachhead for lateral movement, expanding their reach within the network. Observed consequences have included the deployment of web shells, cryptominers, and ransomware. The widespread exploitation of this vulnerability has affected numerous organizations across various sectors, resulting in significant financial and reputational damage.

Recommendation

• Apply the latest security patches released by Atlassian to address CVE-2022-26134 on all Confluence servers immediately.
• Deploy the Sigma rule "Detect Confluence CVE-2022-26134 Exploitation Attempts" to your SIEM to identify suspicious requests containing OGNL injection patterns.
• Implement the Sigma rule "Detect Confluence CVE-2022-26134 Exploitation with ProcessBuilder" to identify exploit attempts leveraging ProcessBuilder.
• Monitor web server logs for requests containing suspicious URL patterns, particularly those including ${, %2F%7B, org.apache.commons.io.IOUtils, and java.lang.Runtime.
• Review and restrict network access to Confluence servers, limiting connections to only trusted sources.